From 8f2b3c6b69f78042efbe3bf7a9aac1ede1e5188c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <carter.li@eoitek.com>
Date: Sat, 15 Apr 2023 10:22:46 +0800
Subject: [PATCH] Processes: code refactor

---
 src/detection/processes/processes.h           |  2 +-
 src/detection/processes/processes_bsd.c       | 11 +++--
 src/detection/processes/processes_linux.c     |  8 ++--
 src/detection/processes/processes_windows.cpp | 44 +++++++------------
 src/modules/processes.c                       | 11 ++---
 5 files changed, 32 insertions(+), 44 deletions(-)

diff --git a/src/detection/processes/processes.h b/src/detection/processes/processes.h
index 74b29e1bb..3feaaed87 100644
--- a/src/detection/processes/processes.h
+++ b/src/detection/processes/processes.h
@@ -5,6 +5,6 @@
 
 #include "fastfetch.h"
 
-uint32_t ffDetectProcesses(FFstrbuf* error);
+const char* ffDetectProcesses(uint32_t* result);
 
 #endif
diff --git a/src/detection/processes/processes_bsd.c b/src/detection/processes/processes_bsd.c
index 36bb14773..bc8cdaaeb 100644
--- a/src/detection/processes/processes_bsd.c
+++ b/src/detection/processes/processes_bsd.c
@@ -6,15 +6,14 @@
     #include <sys/user.h>
 #endif
 
-uint32_t ffDetectProcesses(FFstrbuf* error)
+const char* ffDetectProcesses(uint32_t* result)
 {
     int request[] = {CTL_KERN, KERN_PROC, KERN_PROC_ALL};
     size_t length;
 
     if(sysctl(request, sizeof(request) / sizeof(*request), NULL, &length, NULL, 0) != 0)
-    {
-        ffStrbufAppendS(error, "sysctl() failed");
-        return 0;
-    }
-    return (uint32_t)(length / sizeof(struct kinfo_proc));
+        return "sysctl({CTL_KERN, KERN_PROC, KERN_PROC_ALL}) failed";
+
+    *result = (uint32_t)(length / sizeof(struct kinfo_proc));
+    return NULL;
 }
diff --git a/src/detection/processes/processes_linux.c b/src/detection/processes/processes_linux.c
index 91871f867..7e17fbc9a 100644
--- a/src/detection/processes/processes_linux.c
+++ b/src/detection/processes/processes_linux.c
@@ -2,10 +2,12 @@
 
 #include <sys/sysinfo.h>
 
-uint32_t ffDetectProcesses(FFstrbuf* error)
+const char* ffDetectProcesses(uint32_t* result)
 {
     struct sysinfo info;
     if(sysinfo(&info) != 0)
-        ffStrbufAppendS(error, "sysinfo() failed");
-    return (uint32_t) info.procs;
+        return "sysinfo() failed";
+
+    *result = (uint32_t) info.procs;
+    return NULL;
 }
diff --git a/src/detection/processes/processes_windows.cpp b/src/detection/processes/processes_windows.cpp
index 69a494629..bfccff079 100644
--- a/src/detection/processes/processes_windows.cpp
+++ b/src/detection/processes/processes_windows.cpp
@@ -8,57 +8,47 @@ extern "C" {
 #include <ntstatus.h>
 #include <winternl.h>
 
-uint32_t ffDetectProcesses(FFstrbuf* error)
+const char* ffDetectProcesses(uint32_t* result)
 {
     ULONG size = 0;
     if(NtQuerySystemInformation(SystemProcessInformation, nullptr, 0, &size) != STATUS_INFO_LENGTH_MISMATCH)
-    {
-        ffStrbufAppendS(error, "NtQuerySystemInformation(SystemProcessInformation, NULL) failed");
-        return 0;
-    }
+        return "NtQuerySystemInformation(SystemProcessInformation, NULL) failed";
+
     size += sizeof(SystemProcessInformation) * 5; //What if new processes are created during two syscalls?
 
     SYSTEM_PROCESS_INFORMATION* FF_AUTO_FREE pstart = (SYSTEM_PROCESS_INFORMATION*)malloc(size);
     if(!pstart)
-    {
-        ffStrbufAppendF(error, "malloc(%u) failed", (unsigned)size);
-        return 0;
-    }
+        return "malloc(size) failed";
 
     if(!NT_SUCCESS(NtQuerySystemInformation(SystemProcessInformation, pstart, size, nullptr)))
-    {
-        ffStrbufAppendS(error, "NtQuerySystemInformation(SystemProcessInformation, pstart) failed");
-        return 0;
-    }
+        return "NtQuerySystemInformation(SystemProcessInformation, pstart) failed";
 
-    uint32_t result = 1; //Init with 1 because we test for ptr->NextEntryOffset
+    *result = 1; //Init with 1 because we test for ptr->NextEntryOffset
     for (auto ptr = pstart; ptr->NextEntryOffset; ptr = (SYSTEM_PROCESS_INFORMATION*)((uint8_t*)ptr + ptr->NextEntryOffset))
-        ++result;
+        ++*result;
 
-    return result;
+    return NULL;
 }
 
 #else
 
 #include "util/windows/wmi.hpp"
 
-uint32_t ffDetectProcesses(FFstrbuf* error)
+const char* ffDetectProcesses(uint32_t* result)
 {
-    FFWmiQuery query(L"SELECT NumberOfProcesses FROM Win32_OperatingSystem", error);
+    FFWmiQuery query(L"SELECT NumberOfProcesses FROM Win32_OperatingSystem", NULL);
     if(!query)
-        return 0;
+        return "Query WMI service failed";
 
     if(FFWmiRecord record = query.next())
     {
-        uint64_t result = 0;
-        record.getUnsigned(L"NumberOfProcesses", &result);
-        return (uint32_t)result;
-    }
-    else
-    {
-        ffStrbufAppendS(error, "No Wmi result returned");
-        return 0;
+        uint64_t value = 0;
+        record.getUnsigned(L"NumberOfProcesses", &value);
+        *result = (uint32_t)value;
+        return NULL;
     }
+
+    return "No Wmi result returned";
 }
 
 #endif
diff --git a/src/modules/processes.c b/src/modules/processes.c
index 5157f79b6..70a64ad83 100644
--- a/src/modules/processes.c
+++ b/src/modules/processes.c
@@ -7,17 +7,14 @@
 
 void ffPrintProcesses(FFinstance* instance)
 {
-    FFstrbuf error;
-    ffStrbufInit(&error);
-    uint32_t numProcesses = ffDetectProcesses(&error);
+    uint32_t numProcesses = 0;
+    const char* error = ffDetectProcesses(&numProcesses);
 
-    if(error.length > 0)
+    if(error)
     {
-        ffPrintError(instance, FF_PROCESSES_MODULE_NAME, 0, &instance->config.processes, "%*s", error.length, error.chars);
-        ffStrbufDestroy(&error);
+        ffPrintError(instance, FF_PROCESSES_MODULE_NAME, 0, &instance->config.processes, "%s", error);
         return;
     }
-    ffStrbufDestroy(&error);
 
     if(instance->config.processes.outputFormat.length == 0)
     {